CVE-2026-43643— Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Quick assessment

Copy summary Copy citation

Affected

Softaculous Virtualizor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_

CVE-2026-43643 affects Softaculous Virtualizor. No confirmed in-the-wild exploitation; assess based on exposure. Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers t CVE-2026-43643 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-43643

I. Basic Information for CVE-2026-43643

Affected Products

II. Public POCs for CVE-2026-43643

III. Intelligence Information for CVE-2026-43643

Other References for CVE-2026-43643 (4)

• https://www.vulncheck.com/advisories/softaculous-virtualizor-authorization-bypass-via-billing-module-handler third-party-advisory
• https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce technical-description exploit
• https://www.virtualizor.com/blog/virtualizor-3-3-0/ release-notes patch
• https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/ release-notes patch

• https://www.cve.org/CVERecord?id=CVE-2026-43643

Same Patch Batch · Softaculous · 2026-09-22 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-43643